new(anomalydetection): init config + start behavior profile extraction

Signed-off-by: Melissa Kilby <[email protected]>
falcosecurity · Jun 21, 2024 · 78a8cec · 78a8cec
1 parent f7155df
commit 78a8cec
Show file tree

Hide file tree

Showing 11 changed files with 1,589 additions and 76 deletions.
diff --git a/plugins/anomalydetection/README.md b/plugins/anomalydetection/README.md
diff --git a/plugins/anomalydetection/cmake/modules/libs.cmake b/plugins/anomalydetection/cmake/modules/libs.cmake
@@ -17,7 +17,7 @@ message(STATUS "Fetching libs at 'https://github.com/falcosecurity/libs.git'")
 FetchContent_Declare(
   libs
   GIT_REPOSITORY https://github.com/falcosecurity/libs.git
-  GIT_TAG c6ff3d0731c6873c4fa9bf8df57480fe833aa710
+  GIT_TAG 273299c5832ab7efa6a93547f7c3bd55706b135c
   CONFIGURE_COMMAND "" BUILD_COMMAND "")
 
 FetchContent_MakeAvailable(libs)

diff --git a/plugins/anomalydetection/src/num/cms.h b/plugins/anomalydetection/src/num/cms.h
@@ -98,7 +98,7 @@ class cms
         // Note: d is typically very small (e.g. < 10)
         for (uint64_t seed = 0; seed < d_; ++seed)
         {
-            T index = hash_XXH3_seed(value, seed) % w_;
+            uint64_t index = hash_XXH3_seed(value, seed) % w_;
             sketch[seed][index] += count;
             estimates.push_back(sketch[seed][index]);
         }
@@ -113,7 +113,7 @@ class cms
         // Note: d is typically very small (e.g. < 10)
         for (uint64_t seed = 0; seed < d_; ++seed)
         {
-            T index = hash_XXH3_seed(value, seed) % w_;
+            uint64_t index = hash_XXH3_seed(value, seed) % w_;
             estimates.push_back(sketch[seed][index]);
         }
         auto min_element = std::min_element(estimates.begin(), estimates.end());
@@ -166,10 +166,10 @@ class cms
     }
 
     cms(cms&&) noexcept = default;
-	cms(const cms&) = default;
-	cms& operator=(cms&&) noexcept = default;
-	cms& operator=(const cms&) = default;
-	cms() = delete;
+    cms(const cms&) = default;
+    cms& operator=(cms&&) noexcept = default;
+    cms& operator=(const cms&) = default;
+    cms() = delete;
 };
 
 } // namespace plugin::anomalydetection::num